It's the latter. Dropbox doesn't allow transloading files from arbitrary URLs, so it has to travel through my server.